BunkerWeb
The open-source and next-gen Web Application Firewall (WAF)
FreeHostingOpen SourceAPI37,472 impressions#1 of its week
BunkerWeb is an open-source, reverse-proxy Web Application Firewall that secures web services by default.
- for
- Developers and ops teams needing customizable web security for apps and APIs
- pricing
- freemium · free trial
- license
- AGPL-3.0
- v1.6.16-rc216 days ago
- v1.6.16-rc120 days ago
- v1.6.1520 days ago
Key features
- Reverse proxy with built-in WAF — Acts as a reverse proxy and blocks attacks before they reach your services.
- Modular plugin system — Extend core security with free and paid plugins for anti-bot, ACLs, DDoS protection, etc.
- Web UI configuration — Manage rules, certificates and policies through an intuitive browser interface.
- Seamless integration — Deploy on Linux, Docker, Swarm or Kubernetes with minimal changes to existing stacks.
- Open-source transparency — AGPLv3 licensed code is fully auditable by anyone.
- Rate limiting & bot mitigation — Core plugins like Antibot and Bad Behavior limit abusive traffic.
- Custom rule creation — Create and fine-tune security rules to match specific application needs.
- Community & professional support — Free community plan plus paid PRO plans with priority support.
Use cases
- Protect a public-facing API from OWASP Top 10 attacks
- Add DDoS mitigation to a Kubernetes-hosted web app
- Enforce country-based access control for a SaaS platform
- Secure legacy web apps behind a modern reverse proxy
BunkerWeb pricing
- FreeFreeCore features only · Community support · Self-hosted
- Shield49€/monthAll PRO plugins · Self-hosted · Active community support · 30-day free trial
- Fortress149€/monthAll PRO plugins · Self-hosted for critical environments · Priority support · 30-day free trial
- BunkerWeb CLOUD639€/monthFully managed SaaS · All PRO features · Monitoring platform · Technical support
BunkerWeb FAQ
What is BunkerWeb?+
BunkerWeb is an open-source, next-generation Web Application Firewall that protects web services by default.
What can I protect with BunkerWeb?+
It safeguards web applications, APIs and sites from threats like SQL injection, XSS, DDoS, and provides rate limiting and custom WAF rules.
How does BunkerWeb integrate with existing infrastructure?+
It can be deployed as a standalone server, Docker container, or within Kubernetes, fitting into Linux, Swarm, and cloud environments.
Is BunkerWeb easy to use?+
Yes, it offers a web UI for configuration, clear documentation, and community support for users of all skill levels.
What differentiates BunkerWeb from other WAFs?+
Its open-source license, high customizability via plugins, seamless integration, and active community set it apart.
Summarized by DevHunt from bunkerweb.io · Sep 27, 2026. Details may change; check the official site.